boondmanager-mcp-server 2.9.0 → 2.11.0

package/dist/tools/registration-decorators.d.ts

@@ -0,0 +1,35 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { DomainName } from "../constants.js";
+/**
+ * Per-domain registration decorations, applied centrally in
+ * `server.ts::registerAll` so none of the 38 domain files has to know about
+ * them. Two jobs, both keyed on the domain the registrar belongs to (which the
+ * caller knows for free — it is iterating `TOOL_REGISTRARS`):
+ *
+ *  1. enrich `*_search` input schemas with filter-correction messages
+ *     (`validation-wrapper.ts`);
+ *  2. record `tool name → domain` so the icon layer can attach the right
+ *     domain icon without parsing tool names (`icons.ts`).
+ *
+ * Deliberately NOT merged into `withPolicy`: that wrapper has a fast path
+ * returning the untouched server when no operation filter is active, and these
+ * decorations must apply unconditionally.
+ */
+export interface RegistrationIndex {
+    /**
+     * Tool name → owning domain. Filled at registration time from
+     * `TOOL_REGISTRARS`, so it is exact for multi-word domains
+     * (`provider-invoices`) and for tools whose name doesn't start with their
+     * domain (`boond_workflow_*` ← `workflows`).
+     */
+    toolDomains: Map<string, DomainName>;
+}
+export declare function createRegistrationIndex(): RegistrationIndex;
+/**
+ * Wrap a server (or an already-wrapped Proxy) so every `registerTool` call made
+ * by `domain`'s registrar is decorated. Methods other than `registerTool` pass
+ * straight through, bound to the real target so the SDK's private fields keep
+ * working (same technique as `withPolicy`).
+ */
+export declare function decorateRegistrations(server: McpServer, domain: DomainName, index?: RegistrationIndex): McpServer;
+//# sourceMappingURL=registration-decorators.d.ts.map

package/dist/tools/registration-decorators.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registration-decorators.d.ts","sourceRoot":"","sources":["../../src/tools/registration-decorators.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAGlD;;;;;;;;;;;;;;GAcG;AAEH,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;CACtC;AAED,wBAAgB,uBAAuB,IAAI,iBAAiB,CAE3D;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAmBjH"}

package/dist/tools/registration-decorators.js

@@ -0,0 +1,30 @@
+import { withValidationFeedback } from "./validation-wrapper.js";
+export function createRegistrationIndex() {
+    return { toolDomains: new Map() };
+}
+/**
+ * Wrap a server (or an already-wrapped Proxy) so every `registerTool` call made
+ * by `domain`'s registrar is decorated. Methods other than `registerTool` pass
+ * straight through, bound to the real target so the SDK's private fields keep
+ * working (same technique as `withPolicy`).
+ */
+export function decorateRegistrations(server, domain, index) {
+    return new Proxy(server, {
+        get(target, prop) {
+            const value = Reflect.get(target, prop, target);
+            if (typeof value !== "function")
+                return value;
+            if (prop === "registerTool") {
+                return (...args) => {
+                    const name = args[0];
+                    const config = args[1];
+                    index?.toolDomains.set(name, domain);
+                    const decorated = config === undefined ? config : withValidationFeedback(name, config, domain);
+                    return value.apply(target, [name, decorated, ...args.slice(2)]);
+                };
+            }
+            return value.bind(target);
+        },
+    });
+}
+//# sourceMappingURL=registration-decorators.js.map

package/dist/tools/registration-decorators.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registration-decorators.js","sourceRoot":"","sources":["../../src/tools/registration-decorators.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AA4BjE,MAAM,UAAU,uBAAuB;IACrC,OAAO,EAAE,WAAW,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAiB,EAAE,MAAkB,EAAE,KAAyB;IACpG,OAAO,IAAI,KAAK,CAAC,MAAM,EAAE;QACvB,GAAG,CAAC,MAAM,EAAE,IAAI;YACd,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAY,CAAC;YAC3D,IAAI,OAAO,KAAK,KAAK,UAAU;gBAAE,OAAO,KAAK,CAAC;YAE9C,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;gBAC5B,OAAO,CAAC,GAAG,IAAe,EAAE,EAAE;oBAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;oBAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAA0C,CAAC;oBAChE,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;oBACrC,MAAM,SAAS,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;oBAC/F,OAAQ,KAAsC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACpG,CAAC,CAAC;YACJ,CAAC;YAED,OAAQ,KAAsC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9D,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/tools/resources.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resources.d.ts","sourceRoot":"","sources":["../../src/tools/resources.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AA4LzE,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAuEzB;AA+BD,KAAK,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IAAE,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,CAAC;AAe5E,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,iBAAiB,GAAG,iBAAiB,CAQlF;AAWD,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAwO7D"}
+{"version":3,"file":"resources.d.ts","sourceRoot":"","sources":["../../src/tools/resources.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAyLzE,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAuEzB;AA+BD,KAAK,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IAAE,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,CAAC;AAe5E,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,iBAAiB,GAAG,iBAAiB,CAQlF;AAWD,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAwO7D"}

package/dist/tools/resources.js

@@ -127,20 +127,17 @@ Returns: Liste des demandes d'absences de la ressource.`,
 ];
 const RESOURCE_SEARCH_DESCRIPTION = `Recherche des ressources (collaborateurs internes) dans BoondManager avec filtres serveur.
 
-⚠️ Utilisez les filtres structurés plutôt que la pagination intégrale. Les noms de paramètres ci-dessous sont **ceux exacts** de l'API BoondManager — toute autre orthographe est silencieusement ignorée.
-
 Cas d'usage courants :
 • **Mes données / mon équipe / mon agence** sans connaître son propre ID : \`perimeterDynamic: ["data"]\` (mes ressources), \`["managers"]\` (mes N-1), \`["agencies"]\` (mes agences).
 • **Équipe d'une personne X** : \`perimeterManagers: [<X_id>]\` (filtre les ressources dont X est le N+1).
 • **Mon ID utilisateur** : appeler \`boond_application_current_user\` puis passer cet ID dans \`perimeterManagers\`.
 • **États / types** : \`resourceStates: [<id>]\`, \`resourceTypes: [<id>]\`. IDs entiers issus du dictionnaire (voir \`boond_application_dictionary\` avec \`setting.state.resource\` ou \`setting.typeOf.resource\`). \`excludeResourceStates\` / \`excludeResourceTypes\` pour exclure.
-• **Périmètre organisationnel** : \`perimeterAgencies\`, \`perimeterPoles\`, \`perimeterBusinessUnits\` (IDs entiers). Combiner avec \`narrowPerimeter: true\` pour ET au lieu de OU.
 • **Compétences / outils** : \`tools: [<toolId>, ...]\` (OU par défaut ; pour ET: \`["#AND#", "1", "2"]\`). \`expertiseAreas\`, \`activityAreas\`, \`languages\` (format \`langueId|niveauId\`).
 • **Disponibilité / activité** : \`period: "available"\` + \`startDate\`/\`endDate\`. Autres valeurs : \`working\`, \`hired\`, \`left\`, \`employed\`, \`birthday\`, \`seniority\`…
 • **Recherche par nom** : \`keywords: "Dupont"\` + \`keywordsType: "lastName"\` (ou \`firstName\`, \`fullName\` avec \`keywords: "Dupont#Jean"\`).
 • **Géolocalisation** : \`coordinates: "48.85,2.35"\` (ou \`location: "Paris"\`) + \`geoDistance: 50\` (km).
 
-Pagination : \`page\` (1+), \`pageSize\` (1-500). Tri : \`sort: "lastName"\` (ou firstName/title/availability/state/updateDate/creationDate) + \`order: "asc"|"desc"\`.
+Tri : \`sort: "lastName"\` (ou firstName/title/availability/state/updateDate/creationDate) + \`order: "asc"|"desc"\`.
 
 Returns : liste paginée. Utiliser \`boond_resources_get\` ou les outils d'onglets pour le détail.`;
 // Merge a partial DT payload into the current DT attributes per the rules

package/dist/tools/resources.js.map

@@ -1 +1 @@
-{"version":3,"file":"resources.js","sourceRoot":"","sources":["../../src/tools/resources.ts"],"names":[],"mappings":"AACA,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,iCAAiC,EACjC,qBAAqB,EACrB,qBAAqB,EACrB,iBAAiB,EACjB,QAAQ,GACT,MAAM,qBAAqB,CAAC;AAQ7B,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAElG,MAAM,IAAI,GAAG;IACX,UAAU,EAAE,WAAW;IACvB,gBAAgB,EAAE,YAAY;IAC9B,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,iBAAiB;CAC1B,CAAC;AAEF,MAAM,oBAAoB,GAAG;IAC3B,YAAY,EAAE,IAAI;IAClB,eAAe,EAAE,KAAK;IACtB,cAAc,EAAE,IAAI;IACpB,aAAa,EAAE,KAAK;CACZ,CAAC;AASX,MAAM,aAAa,GAAoB;IACrC;QACE,IAAI,EAAE,aAAa;QACnB,GAAG,EAAE,aAAa;QAClB,KAAK,EAAE,wCAAwC;QAC/C,WAAW,EAAE;;;;;kEAKiD;KAC/D;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,GAAG,EAAE,gBAAgB;QACrB,KAAK,EAAE,wCAAwC;QAC/C,WAAW,EAAE;;;;;4DAK2C;KACzD;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,GAAG,EAAE,gBAAgB;QACrB,KAAK,EAAE,yCAAyC;QAChD,WAAW,EAAE;;;;;wDAKuC;KACrD;IACD;QACE,IAAI,EAAE,YAAY;QAClB,GAAG,EAAE,YAAY;QACjB,KAAK,EAAE,2BAA2B;QAClC,WAAW,EAAE;;;;;8CAK6B;KAC3C;IACD;QACE,IAAI,EAAE,SAAS;QACf,GAAG,EAAE,SAAS;QACd,KAAK,EAAE,+BAA+B;QACtC,WAAW,EAAE;;;;;iDAKgC;KAC9C;IACD;QACE,IAAI,EAAE,cAAc;QACpB,GAAG,EAAE,cAAc;QACnB,KAAK,EAAE,iCAAiC;QACxC,WAAW,EAAE;;;;;oDAKmC;KACjD;IACD;QACE,IAAI,EAAE,UAAU;QAChB,GAAG,EAAE,UAAU;QACf,KAAK,EAAE,yBAAyB;QAChC,WAAW,EAAE;;;;;4CAK2B;KACzC;IACD;QACE,IAAI,EAAE,eAAe;QACrB,GAAG,EAAE,eAAe;QACpB,KAAK,EAAE,mCAAmC;QAC1C,WAAW,EAAE;;;;;sDAKqC;KACnD;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,GAAG,EAAE,kBAAkB;QACvB,KAAK,EAAE,gCAAgC;QACvC,WAAW,EAAE;;;;;mDAKkC;KAChD;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,GAAG,EAAE,kBAAkB;QACvB,KAAK,EAAE,qCAAqC;QAC5C,WAAW,EAAE;;;;;wDAKuC;KACrD;CACF,CAAC;AAEF,MAAM,2BAA2B,GAAG;;;;;;;;;;;;;;;;;kGAiB8D,CAAC;AAKnG,0EAA0E;AAC1E,+EAA+E;AAC/E,qEAAqE;AACrE,MAAM,UAAU,kBAAkB,CAChC,OAAgC,EAChC,KAA8B;IAE9B,MAAM,GAAG,GAA4B,EAAE,CAAC;IAExC,MAAM,OAAO,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;IAE1E,wDAAwD;IACxD,KAAK,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,CAAU,EAAE,CAAC;QAC5D,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC;QAC/B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;QACpC,CAAC;IACH,CAAC;IAED,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE,CAC1B,CAAC;aACE,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAC1D,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YACtC,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;YAC1B,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC9B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,MAAM,GAAG,CAAC,GAAG,OAAO,EAAE,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,CAAC,gBAAgB,EAAE,eAAe,EAAE,UAAU,CAAU,EAAE,CAAC;QAC3E,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,OAAO,CAAC,GAAG,CAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACjG,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YACtD,MAAM,MAAM,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC;YACxB,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;gBAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;gBACtB,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;gBAC1B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;oBACjB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;oBACZ,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACjB,CAAC;YACH,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC;QACpB,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,OAAO,CAAC,KAAwC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClG,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QACvE,MAAM,SAAS,GAAI,KAAK,CAAC,KAAsB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAC3G,GAAG,CAAC,KAAK,GAAG,CAAC,GAAG,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC;IACrC,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAE,OAAO,CAAC,SAA4C,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1G,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAC3E,MAAM,SAAS,GAAI,KAAK,CAAC,SAA8B,CAAC,MAAM,CAC5D,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC,CACvD,CAAC;QACF,GAAG,CAAC,SAAS,GAAG,CAAC,GAAG,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC;IACzC,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,iCAAiC,GAAG;;;;;;;;;;;;kIAYwF,CAAC;AAEnI,MAAM,4BAA4B,GAAG;;;;;;;yGAOoE,CAAC;AAE1G,MAAM,4BAA4B,GAAG;;8IAEyG,CAAC;AAE/I,MAAM,4BAA4B,GAAG,8NAA8N,CAAC;AAIpQ,KAAK,UAAU,4BAA4B,CAAC,UAAkB;IAC5D,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,cAAc,UAAU,iBAAiB,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;IAC/E,MAAM,IAAI,GAAI,MAAM,EAAE,UAAuC,EAAE,UAAU,CAAC;IAC1E,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,IAA4B,CAAC,CAAC,CAAC,EAAE,CAAC;AAClE,CAAC;AAED,6EAA6E;AAC7E,6EAA6E;AAC7E,wEAAwE;AACxE,2EAA2E;AAC3E,uEAAuE;AACvE,qCAAqC;AACrC,MAAM,UAAU,wBAAwB,CAAC,GAAsB;IAC7D,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI;YAAE,SAAS;QAC5C,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE;YAAE,SAAS;QAChD,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACb,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,0BAA0B,CACvC,UAAkB,EAClB,UAA+B;IAE/B,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,gBAAgB,CAAC,UAAU,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,UAAU,CAAC,CAAC;IACjF,OAAO,UAAU,CAAC,cAAc,UAAU,iBAAiB,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAAiB;IACrD,kBAAkB,CAAC,MAAM,EAAE,IAAI,EAAE;QAC/B,MAAM,EAAE,oBAAoB;QAC5B,WAAW,EAAE,2BAA2B;KACzC,CAAC,CAAC;IACH,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAE9B,kBAAkB,CAAC,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,MAAM,EAAE,EAAE;QAChE,MAAM,EAAE,GAAG,KAAK,EAAE,GAAG,MAAM,CAAC;QAC5B,OAAO,gBAAgB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,yEAAyE;IACzE,+EAA+E;IAC/E,yEAAyE;IACzE,kBAAkB,CAChB,MAAM,EACN,IAAI,EACJ,oBAAoB,EACpB,CAAC,MAAM,EAAE,EAAE;QACT,MAAM,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,GAAG,MAAM,CAAC;QAChC,OAAO,gBAAgB,CAAC,UAAU,EAAE,KAAK,EAAE,EAAY,CAAC,CAAC;IAC3D,CAAC,EACD,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,CAC7C,CAAC;IAEF,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAEjC,qCAAqC;IACrC,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QAChC,MAAM,CAAC,YAAY,CACjB,mBAAmB,GAAG,CAAC,IAAI,EAAE,EAC7B;YACE,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,WAAW,EAAE,QAAQ;YACrB,WAAW,EAAE,oBAAoB;SAClC,EACD,KAAK,EAAE,MAAe,EAAE,EAAE;YACxB,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,cAAc,MAAM,CAAC,EAAE,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;YACxE,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YACzC,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,CAAC;aAC3C,CAAC;QACJ,CAAC,CACF,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,YAAY,CACjB,uCAAuC,EACvC;QACE,KAAK,EAAE,oDAAoD;QAC3D,WAAW,EAAE,iCAAiC;QAC9C,WAAW,EAAE,iCAAiC;QAC9C,WAAW,EAAE;YACX,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,KAAK;SACrB;KACF,EACD,KAAK,EAAE,MAAwC,EAAE,EAAE;QACjD,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;QACrC,MAAM,QAAQ,GAA4B,MAAM,CAAC,WAAW,CAC1D,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CACxD,CAAC;QAEF,IAAI,UAAmC,CAAC;QACxC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,UAAU,GAAG,QAAQ,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,MAAM,eAAe,GAAG,MAAM,UAAU,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC;YAC5E,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC;YAC3G,MAAM,YAAY,GAAG,CAAC,aAAa,EAAE,UAAU,IAAI,EAAE,CAA4B,CAAC;YAClF,UAAU,GAAG,kBAAkB,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzC,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,yBAAyB,EAAE,kDAAkD,IAAI,IAAI;qBAC5F;iBACF;aACF,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,gBAAgB,CAAC,UAAU,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,cAAc,EAAE,iBAAiB,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAClF,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,wCAAwC,EAAE,sBAAsB,IAAI,SAAS,oBAAoB,CAAC,QAAQ,CAAC,EAAE;iBACpH;aACF;SACF,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,kCAAkC,EAClC;QACE,KAAK,EAAE,wDAAwD;QAC/D,WAAW,EAAE,4BAA4B;QACzC,WAAW,EAAE,qBAAqB;QAClC,WAAW,EAAE;YACX,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,KAAK;YACrB,aAAa,EAAE,KAAK;SACrB;KACF,EACD,KAAK,EAAE,MAA4B,EAAE,EAAE;QACrC,MAAM,EAAE,UAAU,EAAE,GAAG,KAAK,EAAE,GAAG,MAAM,CAAC;QACxC,MAAM,QAAQ,GAA4B,MAAM,CAAC,WAAW,CAC1D,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CACzD,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC,UAAU,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,CAAC,GAAG,OAAO,EAAE,QAA6B,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC/E,MAAM,IAAI,GAAG,CAAE,MAAM,EAAE,UAAmD,EAAE,UAAU;YACpF,EAAE,CAAwB,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACtC,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,uCAAuC,UAAU,KAAK,IAAI,CAAC,MAAM,iCAAiC,OAAO,EAAE,EAAE,IAAI,gBAAgB,OAAO,oBAAoB,CAAC,QAAQ,CAAC,EAAE;iBAC/K;aACF;SACF,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,kCAAkC,EAClC;QACE,KAAK,EAAE,yCAAyC;QAChD,WAAW,EAAE,4BAA4B;QACzC,WAAW,EAAE,qBAAqB;QAClC,WAAW,EAAE;YACX,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,KAAK;SACrB;KACF,EACD,KAAK,EAAE,MAA4B,EAAE,EAAE;QACrC,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,KAAK,EAAE,GAAG,MAAM,CAAC;QACrD,MAAM,QAAQ,GAA4B,MAAM,CAAC,WAAW,CAC1D,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CACzD,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC,UAAU,CAAC,CAAC;QAC/D,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;QAC3E,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,gBAAgB,WAAW,kCAAkC,UAAU,mBAAmB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,GAAG;qBACpJ;iBACF;aACF,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;QAC1B,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7C,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACpE,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,gBAAgB,WAAW,kCAAkC,UAAU,QAAQ,oBAAoB,CAAC,QAAQ,CAAC,EAAE;iBACtH;aACF;SACF,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,kCAAkC,EAClC;QACE,KAAK,EAAE,0CAA0C;QACjD,WAAW,EAAE,4BAA4B;QACzC,WAAW,EAAE,iBAAiB;QAC9B,WAAW,EAAE;YACX,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,IAAI;YACrB,cAAc,EAAE,KAAK;YACrB,aAAa,EAAE,KAAK;SACrB;KACF,EACD,KAAK,EAAE,MAAwB,EAAE,EAAE;QACjC,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC;QAC3C,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;QAC7E,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC;YAC5B,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,kCAAkC,WAAW,6BAA6B;qBACjF;iBACF;aACF,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC,UAAU,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;QACzE,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;YACnC,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,gBAAgB,WAAW,kCAAkC,UAAU,mBAAmB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,GAAG;qBACpJ;iBACF;aACF,CAAC;QACJ,CAAC;QACD,MAAM,0BAA0B,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACnD,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,kBAAkB,WAAW,+BAA+B,UAAU,KAAK,IAAI,CAAC,MAAM,6BAA6B;iBAC1H;aACF;SACF,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"resources.js","sourceRoot":"","sources":["../../src/tools/resources.ts"],"names":[],"mappings":"AACA,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,iCAAiC,EACjC,qBAAqB,EACrB,qBAAqB,EACrB,iBAAiB,EACjB,QAAQ,GACT,MAAM,qBAAqB,CAAC;AAQ7B,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAElG,MAAM,IAAI,GAAG;IACX,UAAU,EAAE,WAAW;IACvB,gBAAgB,EAAE,YAAY;IAC9B,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,iBAAiB;CAC1B,CAAC;AAEF,MAAM,oBAAoB,GAAG;IAC3B,YAAY,EAAE,IAAI;IAClB,eAAe,EAAE,KAAK;IACtB,cAAc,EAAE,IAAI;IACpB,aAAa,EAAE,KAAK;CACZ,CAAC;AASX,MAAM,aAAa,GAAoB;IACrC;QACE,IAAI,EAAE,aAAa;QACnB,GAAG,EAAE,aAAa;QAClB,KAAK,EAAE,wCAAwC;QAC/C,WAAW,EAAE;;;;;kEAKiD;KAC/D;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,GAAG,EAAE,gBAAgB;QACrB,KAAK,EAAE,wCAAwC;QAC/C,WAAW,EAAE;;;;;4DAK2C;KACzD;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,GAAG,EAAE,gBAAgB;QACrB,KAAK,EAAE,yCAAyC;QAChD,WAAW,EAAE;;;;;wDAKuC;KACrD;IACD;QACE,IAAI,EAAE,YAAY;QAClB,GAAG,EAAE,YAAY;QACjB,KAAK,EAAE,2BAA2B;QAClC,WAAW,EAAE;;;;;8CAK6B;KAC3C;IACD;QACE,IAAI,EAAE,SAAS;QACf,GAAG,EAAE,SAAS;QACd,KAAK,EAAE,+BAA+B;QACtC,WAAW,EAAE;;;;;iDAKgC;KAC9C;IACD;QACE,IAAI,EAAE,cAAc;QACpB,GAAG,EAAE,cAAc;QACnB,KAAK,EAAE,iCAAiC;QACxC,WAAW,EAAE;;;;;oDAKmC;KACjD;IACD;QACE,IAAI,EAAE,UAAU;QAChB,GAAG,EAAE,UAAU;QACf,KAAK,EAAE,yBAAyB;QAChC,WAAW,EAAE;;;;;4CAK2B;KACzC;IACD;QACE,IAAI,EAAE,eAAe;QACrB,GAAG,EAAE,eAAe;QACpB,KAAK,EAAE,mCAAmC;QAC1C,WAAW,EAAE;;;;;sDAKqC;KACnD;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,GAAG,EAAE,kBAAkB;QACvB,KAAK,EAAE,gCAAgC;QACvC,WAAW,EAAE;;;;;mDAKkC;KAChD;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,GAAG,EAAE,kBAAkB;QACvB,KAAK,EAAE,qCAAqC;QAC5C,WAAW,EAAE;;;;;wDAKuC;KACrD;CACF,CAAC;AAEF,MAAM,2BAA2B,GAAG;;;;;;;;;;;;;;kGAc8D,CAAC;AAKnG,0EAA0E;AAC1E,+EAA+E;AAC/E,qEAAqE;AACrE,MAAM,UAAU,kBAAkB,CAChC,OAAgC,EAChC,KAA8B;IAE9B,MAAM,GAAG,GAA4B,EAAE,CAAC;IAExC,MAAM,OAAO,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;IAE1E,wDAAwD;IACxD,KAAK,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,CAAU,EAAE,CAAC;QAC5D,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC;QAC/B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;QACpC,CAAC;IACH,CAAC;IAED,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE,CAC1B,CAAC;aACE,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAC1D,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YACtC,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;YAC1B,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC9B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,MAAM,GAAG,CAAC,GAAG,OAAO,EAAE,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,CAAC,gBAAgB,EAAE,eAAe,EAAE,UAAU,CAAU,EAAE,CAAC;QAC3E,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,OAAO,CAAC,GAAG,CAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACjG,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YACtD,MAAM,MAAM,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC;YACxB,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;gBAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;gBACtB,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;gBAC1B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;oBACjB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;oBACZ,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACjB,CAAC;YACH,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC;QACpB,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,OAAO,CAAC,KAAwC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClG,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QACvE,MAAM,SAAS,GAAI,KAAK,CAAC,KAAsB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAC3G,GAAG,CAAC,KAAK,GAAG,CAAC,GAAG,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC;IACrC,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAE,OAAO,CAAC,SAA4C,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1G,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAC3E,MAAM,SAAS,GAAI,KAAK,CAAC,SAA8B,CAAC,MAAM,CAC5D,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC,CACvD,CAAC;QACF,GAAG,CAAC,SAAS,GAAG,CAAC,GAAG,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC;IACzC,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,iCAAiC,GAAG;;;;;;;;;;;;kIAYwF,CAAC;AAEnI,MAAM,4BAA4B,GAAG;;;;;;;yGAOoE,CAAC;AAE1G,MAAM,4BAA4B,GAAG;;8IAEyG,CAAC;AAE/I,MAAM,4BAA4B,GAAG,8NAA8N,CAAC;AAIpQ,KAAK,UAAU,4BAA4B,CAAC,UAAkB;IAC5D,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,cAAc,UAAU,iBAAiB,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;IAC/E,MAAM,IAAI,GAAI,MAAM,EAAE,UAAuC,EAAE,UAAU,CAAC;IAC1E,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,IAA4B,CAAC,CAAC,CAAC,EAAE,CAAC;AAClE,CAAC;AAED,6EAA6E;AAC7E,6EAA6E;AAC7E,wEAAwE;AACxE,2EAA2E;AAC3E,uEAAuE;AACvE,qCAAqC;AACrC,MAAM,UAAU,wBAAwB,CAAC,GAAsB;IAC7D,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI;YAAE,SAAS;QAC5C,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE;YAAE,SAAS;QAChD,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACb,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,0BAA0B,CACvC,UAAkB,EAClB,UAA+B;IAE/B,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,gBAAgB,CAAC,UAAU,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,UAAU,CAAC,CAAC;IACjF,OAAO,UAAU,CAAC,cAAc,UAAU,iBAAiB,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAAiB;IACrD,kBAAkB,CAAC,MAAM,EAAE,IAAI,EAAE;QAC/B,MAAM,EAAE,oBAAoB;QAC5B,WAAW,EAAE,2BAA2B;KACzC,CAAC,CAAC;IACH,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAE9B,kBAAkB,CAAC,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,MAAM,EAAE,EAAE;QAChE,MAAM,EAAE,GAAG,KAAK,EAAE,GAAG,MAAM,CAAC;QAC5B,OAAO,gBAAgB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,yEAAyE;IACzE,+EAA+E;IAC/E,yEAAyE;IACzE,kBAAkB,CAChB,MAAM,EACN,IAAI,EACJ,oBAAoB,EACpB,CAAC,MAAM,EAAE,EAAE;QACT,MAAM,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,GAAG,MAAM,CAAC;QAChC,OAAO,gBAAgB,CAAC,UAAU,EAAE,KAAK,EAAE,EAAY,CAAC,CAAC;IAC3D,CAAC,EACD,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,CAC7C,CAAC;IAEF,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAEjC,qCAAqC;IACrC,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QAChC,MAAM,CAAC,YAAY,CACjB,mBAAmB,GAAG,CAAC,IAAI,EAAE,EAC7B;YACE,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,WAAW,EAAE,QAAQ;YACrB,WAAW,EAAE,oBAAoB;SAClC,EACD,KAAK,EAAE,MAAe,EAAE,EAAE;YACxB,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,cAAc,MAAM,CAAC,EAAE,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;YACxE,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YACzC,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,CAAC;aAC3C,CAAC;QACJ,CAAC,CACF,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,YAAY,CACjB,uCAAuC,EACvC;QACE,KAAK,EAAE,oDAAoD;QAC3D,WAAW,EAAE,iCAAiC;QAC9C,WAAW,EAAE,iCAAiC;QAC9C,WAAW,EAAE;YACX,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,KAAK;SACrB;KACF,EACD,KAAK,EAAE,MAAwC,EAAE,EAAE;QACjD,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;QACrC,MAAM,QAAQ,GAA4B,MAAM,CAAC,WAAW,CAC1D,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CACxD,CAAC;QAEF,IAAI,UAAmC,CAAC;QACxC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,UAAU,GAAG,QAAQ,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,MAAM,eAAe,GAAG,MAAM,UAAU,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC;YAC5E,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC;YAC3G,MAAM,YAAY,GAAG,CAAC,aAAa,EAAE,UAAU,IAAI,EAAE,CAA4B,CAAC;YAClF,UAAU,GAAG,kBAAkB,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzC,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,yBAAyB,EAAE,kDAAkD,IAAI,IAAI;qBAC5F;iBACF;aACF,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,gBAAgB,CAAC,UAAU,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,cAAc,EAAE,iBAAiB,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAClF,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,wCAAwC,EAAE,sBAAsB,IAAI,SAAS,oBAAoB,CAAC,QAAQ,CAAC,EAAE;iBACpH;aACF;SACF,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,kCAAkC,EAClC;QACE,KAAK,EAAE,wDAAwD;QAC/D,WAAW,EAAE,4BAA4B;QACzC,WAAW,EAAE,qBAAqB;QAClC,WAAW,EAAE;YACX,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,KAAK;YACrB,aAAa,EAAE,KAAK;SACrB;KACF,EACD,KAAK,EAAE,MAA4B,EAAE,EAAE;QACrC,MAAM,EAAE,UAAU,EAAE,GAAG,KAAK,EAAE,GAAG,MAAM,CAAC;QACxC,MAAM,QAAQ,GAA4B,MAAM,CAAC,WAAW,CAC1D,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CACzD,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC,UAAU,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,CAAC,GAAG,OAAO,EAAE,QAA6B,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC/E,MAAM,IAAI,GAAG,CAAE,MAAM,EAAE,UAAmD,EAAE,UAAU;YACpF,EAAE,CAAwB,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACtC,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,uCAAuC,UAAU,KAAK,IAAI,CAAC,MAAM,iCAAiC,OAAO,EAAE,EAAE,IAAI,gBAAgB,OAAO,oBAAoB,CAAC,QAAQ,CAAC,EAAE;iBAC/K;aACF;SACF,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,kCAAkC,EAClC;QACE,KAAK,EAAE,yCAAyC;QAChD,WAAW,EAAE,4BAA4B;QACzC,WAAW,EAAE,qBAAqB;QAClC,WAAW,EAAE;YACX,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,KAAK;SACrB;KACF,EACD,KAAK,EAAE,MAA4B,EAAE,EAAE;QACrC,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,KAAK,EAAE,GAAG,MAAM,CAAC;QACrD,MAAM,QAAQ,GAA4B,MAAM,CAAC,WAAW,CAC1D,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CACzD,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC,UAAU,CAAC,CAAC;QAC/D,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;QAC3E,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,gBAAgB,WAAW,kCAAkC,UAAU,mBAAmB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,GAAG;qBACpJ;iBACF;aACF,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;QAC1B,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7C,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACpE,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,gBAAgB,WAAW,kCAAkC,UAAU,QAAQ,oBAAoB,CAAC,QAAQ,CAAC,EAAE;iBACtH;aACF;SACF,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,kCAAkC,EAClC;QACE,KAAK,EAAE,0CAA0C;QACjD,WAAW,EAAE,4BAA4B;QACzC,WAAW,EAAE,iBAAiB;QAC9B,WAAW,EAAE;YACX,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,IAAI;YACrB,cAAc,EAAE,KAAK;YACrB,aAAa,EAAE,KAAK;SACrB;KACF,EACD,KAAK,EAAE,MAAwB,EAAE,EAAE;QACjC,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC;QAC3C,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;QAC7E,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC;YAC5B,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,kCAAkC,WAAW,6BAA6B;qBACjF;iBACF;aACF,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC,UAAU,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;QACzE,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;YACnC,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,gBAAgB,WAAW,kCAAkC,UAAU,mBAAmB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,GAAG;qBACpJ;iBACF;aACF,CAAC;QACJ,CAAC;QACD,MAAM,0BAA0B,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACnD,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,kBAAkB,WAAW,+BAA+B,UAAU,KAAK,IAAI,CAAC,MAAM,6BAA6B;iBAC1H;aACF;SACF,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/validation-wrapper.d.ts

@@ -0,0 +1,43 @@
+import type { DomainName } from "../constants.js";
+/**
+ * Rebuild a strict object schema with a filter-aware unrecognized-key message.
+ * Anything else (raw shapes, non-strict objects, unions) is returned as-is —
+ * we never make a lenient schema strict as a side effect.
+ *
+ * The rebuild reuses the exact same field schemas, so defaults, descriptions
+ * and per-field messages are preserved. Only issues raised *by the object
+ * itself* reach our error function; a field-level failure (e.g. `page: 500`)
+ * keeps the message its own schema defines, which is why the returned
+ * `undefined` fallback matters.
+ */
+export declare function withFilterHints<T>(schema: T, domain?: DomainName): T;
+interface ToolConfigLike {
+    inputSchema?: unknown;
+    annotations?: {
+        openWorldHint?: boolean;
+    };
+}
+/**
+ * Is this a search-shaped tool, i.e. one whose filter vocabulary is worth
+ * explaining?
+ *
+ * Keyed on the *registration* rather than the name only. `openWorldHint: true`
+ * is exactly the annotation the codebase reserves for paginated,
+ * keyword-filtered listing tools (see CLAUDE.md §MCP Annotations), so it catches
+ * `boond_reporting_{companies,projects,resources,synthesis,production_plans}` —
+ * strict schemas carrying the same treacherous `perimeter*` / `*States`
+ * vocabulary, which a `_search` suffix test silently skipped — and any future
+ * hand-rolled search tool that doesn't happen to be named `*_search`. The name
+ * check is kept as an OR so a listing tool that omits the annotation is still
+ * covered.
+ */
+export declare function isSearchTool(name: string, config?: ToolConfigLike): boolean;
+/**
+ * Return the registration config a search tool should be registered with:
+ * the same object with its `inputSchema` swapped for the hint-enriched clone.
+ * Non-search tools and configs without a strict object schema come back
+ * untouched (same reference), so this is a no-op for the ~150 other tools.
+ */
+export declare function withValidationFeedback<C extends ToolConfigLike>(name: string, config: C, domain?: DomainName): C;
+export {};
+//# sourceMappingURL=validation-wrapper.d.ts.map

package/dist/tools/validation-wrapper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation-wrapper.d.ts","sourceRoot":"","sources":["../../src/tools/validation-wrapper.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAoDlD;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,EAAE,UAAU,GAAG,CAAC,CAYpE;AAED,UAAU,cAAc;IACtB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,WAAW,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CAC3C;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,cAAc,GAAG,OAAO,CAE3E;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,CAAC,SAAS,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,EAAE,UAAU,GAAG,CAAC,CAKhH"}

package/dist/tools/validation-wrapper.js

@@ -0,0 +1,108 @@
+import { z } from "zod";
+import { unknownFilterMessage, ENDPOINT_FILTER_ALIASES } from "../schemas/filter-aliases.js";
+/**
+ * Turn a `.strict()` search schema's unrecognized-key rejection into a
+ * correction the model can act on (SEP-1303).
+ *
+ * ## Why this is a *schema* wrapper and not a handler wrapper
+ *
+ * The issue this implements proposed wrapping the tool handler and
+ * `safeParse`-ing before the SDK does. That cannot work: `McpServer` validates
+ * the input **before** invoking the handler
+ * (`server/mcp.js::validateToolInput`), so on a validation failure the handler
+ * is never reached. The two options left were (a) declare a permissive schema
+ * to the SDK and validate strictly ourselves — which drops
+ * `additionalProperties: false` from the advertised `inputSchema`, the thing
+ * that lets a client validate before it even calls us — or (b) keep the strict
+ * schema and make *its own* error message the correction. We do (b):
+ *
+ * - the advertised `inputSchema` is byte-for-byte what it was before (verified
+ *   in the tests: the rebuilt schema's JSON Schema is unchanged);
+ * - there is no second parse, so nothing is added to the hot path of a search;
+ * - the SDK already reports a validation failure as a *tool* error
+ *   (`isError: true`) rather than a protocol error — it catches its own
+ *   `McpError` and funnels it through `createToolError`. So SEP-1303's
+ *   requirement is met by the SDK; what was missing, and what this adds, is a
+ *   message worth self-correcting from.
+ *
+ * Applied to search-shaped tools only (see `isSearchTool`): that is where the
+ * filter vocabulary is treacherous (`mainManagers` vs `perimeterManagers`,
+ * `states` vs `resourceStates`). `get`/`create`/`update` take ids and attribute
+ * names the model reads straight off the schema.
+ */
+/** Does the domain have an endpoint-specific filter vocabulary? */
+function searchEndpointOf(domain) {
+    if (domain !== undefined && Object.hasOwn(ENDPOINT_FILTER_ALIASES, domain))
+        return domain;
+    return undefined;
+}
+/**
+ * A Zod v4 object schema that *rejects* unknown keys — i.e. `catchall` is
+ * `ZodNever`, not merely present. `.catchall(z.string())` also sets it, and
+ * rebuilding such a schema as `strictObject` would silently turn a permissive
+ * schema into a strict one.
+ */
+function isStrictObject(schema) {
+    if (!(schema instanceof z.ZodObject))
+        return false;
+    const def = schema._zod?.def;
+    return def?.catchall instanceof z.ZodNever;
+}
+/**
+ * Rebuild a strict object schema with a filter-aware unrecognized-key message.
+ * Anything else (raw shapes, non-strict objects, unions) is returned as-is —
+ * we never make a lenient schema strict as a side effect.
+ *
+ * The rebuild reuses the exact same field schemas, so defaults, descriptions
+ * and per-field messages are preserved. Only issues raised *by the object
+ * itself* reach our error function; a field-level failure (e.g. `page: 500`)
+ * keeps the message its own schema defines, which is why the returned
+ * `undefined` fallback matters.
+ */
+export function withFilterHints(schema, domain) {
+    if (!isStrictObject(schema))
+        return schema;
+    const shape = schema.shape;
+    const validKeys = Object.keys(shape);
+    const endpoint = searchEndpointOf(domain);
+    return z.strictObject(shape, {
+        error: (issue) => {
+            const raw = issue;
+            if (raw.code !== "unrecognized_keys" || !Array.isArray(raw.keys))
+                return undefined;
+            return unknownFilterMessage(raw.keys.map(String), validKeys, endpoint);
+        },
+    });
+}
+/**
+ * Is this a search-shaped tool, i.e. one whose filter vocabulary is worth
+ * explaining?
+ *
+ * Keyed on the *registration* rather than the name only. `openWorldHint: true`
+ * is exactly the annotation the codebase reserves for paginated,
+ * keyword-filtered listing tools (see CLAUDE.md §MCP Annotations), so it catches
+ * `boond_reporting_{companies,projects,resources,synthesis,production_plans}` —
+ * strict schemas carrying the same treacherous `perimeter*` / `*States`
+ * vocabulary, which a `_search` suffix test silently skipped — and any future
+ * hand-rolled search tool that doesn't happen to be named `*_search`. The name
+ * check is kept as an OR so a listing tool that omits the annotation is still
+ * covered.
+ */
+export function isSearchTool(name, config) {
+    return name.endsWith("_search") || config?.annotations?.openWorldHint === true;
+}
+/**
+ * Return the registration config a search tool should be registered with:
+ * the same object with its `inputSchema` swapped for the hint-enriched clone.
+ * Non-search tools and configs without a strict object schema come back
+ * untouched (same reference), so this is a no-op for the ~150 other tools.
+ */
+export function withValidationFeedback(name, config, domain) {
+    if (!isSearchTool(name, config) || config?.inputSchema === undefined)
+        return config;
+    const enriched = withFilterHints(config.inputSchema, domain);
+    if (enriched === config.inputSchema)
+        return config;
+    return { ...config, inputSchema: enriched };
+}
+//# sourceMappingURL=validation-wrapper.js.map

package/dist/tools/validation-wrapper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation-wrapper.js","sourceRoot":"","sources":["../../src/tools/validation-wrapper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAuB,MAAM,8BAA8B,CAAC;AAElH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,mEAAmE;AACnE,SAAS,gBAAgB,CAAC,MAA8B;IACtD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,uBAAuB,EAAE,MAAM,CAAC;QAAE,OAAO,MAAwB,CAAC;IAC5G,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,MAAe;IACrC,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,MAAM,GAAG,GAAI,MAAiE,CAAC,IAAI,EAAE,GAAG,CAAC;IACzF,OAAO,GAAG,EAAE,QAAQ,YAAY,CAAC,CAAC,QAAQ,CAAC;AAC7C,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAI,MAAS,EAAE,MAAmB;IAC/D,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAC3B,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC1C,OAAO,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE;QAC3B,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,GAAG,GAAG,KAA0C,CAAC;YACvD,IAAI,GAAG,CAAC,IAAI,KAAK,mBAAmB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YACnF,OAAO,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QACzE,CAAC;KACF,CAAiB,CAAC;AACrB,CAAC;AAOD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,MAAuB;IAChE,OAAO,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,MAAM,EAAE,WAAW,EAAE,aAAa,KAAK,IAAI,CAAC;AACjF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAA2B,IAAY,EAAE,MAAS,EAAE,MAAmB;IAC3G,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,EAAE,WAAW,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACpF,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC7D,IAAI,QAAQ,KAAK,MAAM,CAAC,WAAW;QAAE,OAAO,MAAM,CAAC;IACnD,OAAO,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;AAC9C,CAAC"}

package/dist/transports/http.d.ts

@@ -13,11 +13,22 @@ export interface HttpTransportOptions {
     maxSessions?: number;
     /**
      * Allow-list of Host header hostnames (port-agnostic) for DNS rebinding
-     * protection. Empty array = validation disabled. Use `["*"]` to opt out
-     * explicitly. When undefined, a localhost default is applied if bound
-     * to a loopback interface.
+     * protection. Use `["*"]` to opt out explicitly. When undefined **or empty**
+     * (an unset / blank env var), a localhost default is applied if bound to a
+     * loopback interface, and validation is off otherwise — a blank value never
+     * silently disables the check, `*` is the explicit opt-out.
      */
     allowedHosts?: string[];
+    /**
+     * Allow-list of `Origin` header values (scheme + host + port) accepted from
+     * browser-based clients. A request with **no** `Origin` is always accepted
+     * (curl, gateways, non-browser MCP clients); a request carrying an `Origin`
+     * outside this list gets a `403` (MCP 2025-11-25 requirement). Use `["*"]` to
+     * opt out explicitly. When undefined **or empty** (an unset / blank env var),
+     * the loopback default of `resolveOriginPolicy` applies — same rationale as
+     * `allowedHosts`: blank does not mean "disabled".
+     */
+    allowedOrigins?: string[];
     /**
      * Public URL clients use to reach this MCP endpoint — used as the
      * `resource` field of the protected-resource metadata and in the
@@ -52,8 +63,51 @@ export interface HttpServerHandle {
  * bound listen interface. Returns an empty array when validation is disabled
  * (either explicitly via `["*"]` or implicitly when bound to a non-loopback
  * interface without an explicit list).
+ *
+ * An empty `configured` array is treated as *unconfigured*, not as "disabled":
+ * `MCP_HTTP_ALLOWED_HOSTS=` (or a value of only commas) must not quietly turn a
+ * security control off. `["*"]` is the explicit opt-out.
  */
 export declare function resolveAllowedHosts(configured: string[] | undefined, host: string): string[];
+/** Resolved `Origin` validation policy — see `resolveOriginPolicy`. */
+export interface OriginPolicy {
+    /** `false` = validation disabled; every `Origin` is accepted. */
+    enabled: boolean;
+    /** Exact-match allow-list, normalised (see `normalizeOrigin`). */
+    origins: string[];
+    /**
+     * Also accept any `http`/`https` origin whose hostname is a loopback literal,
+     * **on any port**. Set only by the loopback default, never by an explicit
+     * allow-list (an operator who enumerates origins gets exact matching).
+     */
+    allowAnyLoopback: boolean;
+}
+/**
+ * Resolves the effective `Origin` policy, mirroring `resolveAllowedHosts`: an
+ * explicit list wins (exact match, port-sensitive), a sole `*` disables
+ * validation, a `*` mixed with real origins is dropped with a warning
+ * (validation stays on), and the default only applies when bound to a loopback
+ * interface. An empty `configured` array counts as unconfigured, not disabled.
+ *
+ * The loopback default accepts **any loopback origin on any port**, plus the
+ * origin of `publicUrl` when one is configured. Pinning the bound port instead
+ * (the obvious reading of "origins are port-sensitive") would 403 every real
+ * browser client: nothing is ever *served* from this port — it answers JSON-RPC
+ * — so the origins that legitimately show up are other local ports (MCP
+ * Inspector on `:6274`, a dev server on `:5173`) or the proxy's public URL.
+ * The anti-DNS-rebinding property is untouched: a remote page still gets a 403,
+ * and an attacker already running code on the loopback interface can simply
+ * omit the header, which is always accepted.
+ */
+export declare function resolveOriginPolicy(configured: string[] | undefined, host: string, publicUrl?: string): OriginPolicy;
+/** Applies a resolved policy to one `Origin` header value. */
+export declare function isOriginAllowed(policy: OriginPolicy, origin: string): boolean;
+/**
+ * Whether a request targets the public protected-resource metadata document.
+ * Shared by the `Origin` exemption and the handler itself so the two cannot
+ * drift apart. Takes the raw `req.url` — it runs before the `URL` parse.
+ */
+export declare function isDiscoveryPath(reqUrl: string | undefined, mcpPath: string): boolean;
 export declare function resolveHttpOptions(): HttpTransportOptions;
 export declare function startHttpTransport(createServerFactory: () => McpServer, options: HttpTransportOptions): Promise<HttpServerHandle>;
 //# sourceMappingURL=http.d.ts.map

package/dist/transports/http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/transports/http.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAWzE,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,OAAO,CAAC;IACnB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,qEAAqE;IACrE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACtD,4EAA4E;IAC5E,YAAY,EAAE,MAAM,MAAM,CAAC;IAC3B,6EAA6E;IAC7E,iBAAiB,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CAC1C;AAuCD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAmB5F;AAiBD,wBAAgB,kBAAkB,IAAI,oBAAoB,CA0BzD;AAkFD,wBAAsB,kBAAkB,CACtC,mBAAmB,EAAE,MAAM,SAAS,EACpC,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,gBAAgB,CAAC,CAqS3B"}
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/transports/http.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAWzE,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,OAAO,CAAC;IACnB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,qEAAqE;IACrE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACtD,4EAA4E;IAC5E,YAAY,EAAE,MAAM,MAAM,CAAC;IAC3B,6EAA6E;IAC7E,iBAAiB,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CAC1C;AA8CD;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAmB5F;AAwCD,uEAAuE;AACvE,MAAM,WAAW,YAAY;IAC3B,iEAAiE;IACjE,OAAO,EAAE,OAAO,CAAC;IACjB,kEAAkE;IAClE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB;;;;OAIG;IACH,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAID;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,YAAY,CAkBpH;AAkBD,8DAA8D;AAC9D,wBAAgB,eAAe,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAK7E;AAKD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAGpF;AAiBD,wBAAgB,kBAAkB,IAAI,oBAAoB,CA2BzD;AAkFD,wBAAsB,kBAAkB,CACtC,mBAAmB,EAAE,MAAM,SAAS,EACpC,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,gBAAgB,CAAC,CAmT3B"}

package/dist/transports/http.js

@@ -31,21 +31,30 @@ function readPositiveInt(key, fallback) {
         return fallback;
     return Math.floor(parsed);
 }
-function readAllowedHosts() {
-    const raw = readEnv("MCP_HTTP_ALLOWED_HOSTS");
+function readCsvEnv(key) {
+    const raw = readEnv(key);
     if (raw === undefined)
         return undefined;
-    const parts = raw
+    return raw
         .split(",")
         .map((s) => s.trim())
         .filter((s) => s.length > 0);
-    return parts;
+}
+function readAllowedHosts() {
+    return readCsvEnv("MCP_HTTP_ALLOWED_HOSTS");
+}
+function readAllowedOrigins() {
+    return readCsvEnv("MCP_HTTP_ALLOWED_ORIGINS");
 }
 /**
  * Resolves the effective Host header allow-list given user options and the
  * bound listen interface. Returns an empty array when validation is disabled
  * (either explicitly via `["*"]` or implicitly when bound to a non-loopback
  * interface without an explicit list).
+ *
+ * An empty `configured` array is treated as *unconfigured*, not as "disabled":
+ * `MCP_HTTP_ALLOWED_HOSTS=` (or a value of only commas) must not quietly turn a
+ * security control off. `["*"]` is the explicit opt-out.
  */
 export function resolveAllowedHosts(configured, host) {
     if (configured && configured.length > 0) {
@@ -66,6 +75,117 @@ export function resolveAllowedHosts(configured, host) {
         return LOCALHOST_ALLOWED_HOSTS;
     return [];
 }
+/**
+ * Canonical form of an origin for comparison: lowercased (scheme and host are
+ * case-insensitive) and without a trailing slash (some clients send
+ * `http://localhost:3000/`, the spec form has no path).
+ *
+ * The trailing slashes are stripped with an index scan rather than a
+ * `/\/+$/` replace: this runs on the caller-supplied `Origin` header, and an
+ * anchored quantifier over a long run of `/` backtracks quadratically
+ * (js/polynomial-redos). The scan below is linear whatever the input.
+ */
+function normalizeOrigin(value) {
+    const trimmed = value.trim();
+    let end = trimmed.length;
+    while (end > 0 && trimmed.charCodeAt(end - 1) === 47 /* '/' */)
+        end--;
+    return trimmed.slice(0, end).toLowerCase();
+}
+/**
+ * Whether a normalised origin is a browser page served from the local machine.
+ *
+ * Matching is on the *hostname literal*, not on resolution: `http://127.0.0.1.
+ * nip.io` resolves to a loopback address but its hostname is not in the set, so
+ * it is correctly rejected — that indirection is exactly the DNS rebinding
+ * vector `Origin` validation exists to stop.
+ */
+const LOOPBACK_ORIGIN_HOSTNAMES = new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
+function isLoopbackOrigin(normalizedOrigin) {
+    let url;
+    try {
+        url = new URL(normalizedOrigin);
+    }
+    catch {
+        return false;
+    }
+    if (url.protocol !== "http:" && url.protocol !== "https:")
+        return false;
+    return LOOPBACK_ORIGIN_HOSTNAMES.has(url.hostname);
+}
+const VALIDATION_DISABLED = { enabled: false, origins: [], allowAnyLoopback: false };
+/**
+ * Resolves the effective `Origin` policy, mirroring `resolveAllowedHosts`: an
+ * explicit list wins (exact match, port-sensitive), a sole `*` disables
+ * validation, a `*` mixed with real origins is dropped with a warning
+ * (validation stays on), and the default only applies when bound to a loopback
+ * interface. An empty `configured` array counts as unconfigured, not disabled.
+ *
+ * The loopback default accepts **any loopback origin on any port**, plus the
+ * origin of `publicUrl` when one is configured. Pinning the bound port instead
+ * (the obvious reading of "origins are port-sensitive") would 403 every real
+ * browser client: nothing is ever *served* from this port — it answers JSON-RPC
+ * — so the origins that legitimately show up are other local ports (MCP
+ * Inspector on `:6274`, a dev server on `:5173`) or the proxy's public URL.
+ * The anti-DNS-rebinding property is untouched: a remote page still gets a 403,
+ * and an attacker already running code on the loopback interface can simply
+ * omit the header, which is always accepted.
+ */
+export function resolveOriginPolicy(configured, host, publicUrl) {
+    if (configured && configured.length > 0) {
+        if (configured.includes("*")) {
+            if (configured.length === 1)
+                return VALIDATION_DISABLED;
+            logger.warn({ allowedOrigins: configured }, "MCP_HTTP_ALLOWED_ORIGINS contains '*' alongside other origins; ignoring '*' and keeping Origin validation enabled. Set it to exactly '*' to disable validation.");
+            return {
+                enabled: true,
+                origins: configured.filter((o) => o !== "*").map(normalizeOrigin),
+                allowAnyLoopback: false,
+            };
+        }
+        return { enabled: true, origins: configured.map(normalizeOrigin), allowAnyLoopback: false };
+    }
+    if (!LOOPBACK_HOSTS.has(host))
+        return VALIDATION_DISABLED;
+    return { enabled: true, origins: originOf(publicUrl), allowAnyLoopback: true };
+}
+/**
+ * The scheme+host+port of a configured public URL, as a 0- or 1-element list.
+ * A server bound to loopback behind a reverse proxy is reached by the browser
+ * under that URL, so its origin belongs in the default allow-list — otherwise
+ * the documented proxy deployment 403s until the operator discovers
+ * `MCP_HTTP_ALLOWED_ORIGINS`.
+ */
+function originOf(publicUrl) {
+    if (!publicUrl)
+        return [];
+    try {
+        return [normalizeOrigin(new URL(publicUrl).origin)];
+    }
+    catch {
+        return [];
+    }
+}
+/** Applies a resolved policy to one `Origin` header value. */
+export function isOriginAllowed(policy, origin) {
+    if (!policy.enabled)
+        return true;
+    const normalized = normalizeOrigin(origin);
+    if (policy.origins.includes(normalized))
+        return true;
+    return policy.allowAnyLoopback && isLoopbackOrigin(normalized);
+}
+/** RFC 9728 §3.2: bare metadata path, plus the resource-path-suffixed variant. */
+const OAUTH_METADATA_PATH = "/.well-known/oauth-protected-resource";
+/**
+ * Whether a request targets the public protected-resource metadata document.
+ * Shared by the `Origin` exemption and the handler itself so the two cannot
+ * drift apart. Takes the raw `req.url` — it runs before the `URL` parse.
+ */
+export function isDiscoveryPath(reqUrl, mcpPath) {
+    const pathname = (reqUrl ?? "").split("?")[0];
+    return pathname === OAUTH_METADATA_PATH || pathname === `${OAUTH_METADATA_PATH}${mcpPath}`;
+}
 /**
  * Extracts the hostname (without port) from a Host header. Returns
  * `undefined` if the header is missing or malformed.
@@ -103,6 +223,7 @@ export function resolveHttpOptions() {
         sessionSweepIntervalMs: readPositiveInt("MCP_HTTP_SESSION_SWEEP_INTERVAL_MS", DEFAULT_SESSION_SWEEP_INTERVAL_MS),
         maxSessions: readPositiveInt("MCP_HTTP_MAX_SESSIONS", DEFAULT_MAX_SESSIONS),
         allowedHosts: readAllowedHosts(),
+        allowedOrigins: readAllowedOrigins(),
         publicUrl: readEnv("MCP_HTTP_PUBLIC_URL"),
         staticAuth,
     };
@@ -181,6 +302,7 @@ export async function startHttpTransport(createServerFactory, options) {
     const sessionSweepIntervalMs = options.sessionSweepIntervalMs ?? DEFAULT_SESSION_SWEEP_INTERVAL_MS;
     const maxSessions = options.maxSessions ?? DEFAULT_MAX_SESSIONS;
     const allowedHosts = resolveAllowedHosts(options.allowedHosts, options.host);
+    const originPolicy = resolveOriginPolicy(options.allowedOrigins, options.host, options.publicUrl);
     const resourceUrl = resolveResourceUrl(options);
     const authorizationServer = resolveAuthorizationServer();
     const advertisedScopes = resolveAdvertisedScopes();
@@ -192,7 +314,7 @@ export async function startHttpTransport(createServerFactory, options) {
     const resourceOrigin = resourceUrl.endsWith(options.path)
         ? resourceUrl.slice(0, resourceUrl.length - options.path.length)
         : resourceUrl;
-    const metadataUrl = `${resourceOrigin}/.well-known/oauth-protected-resource${options.path}`;
+    const metadataUrl = `${resourceOrigin}${OAUTH_METADATA_PATH}${options.path}`;
     const wwwAuthenticate = `Bearer realm="${resourceUrl}", resource_metadata="${metadataUrl}"`;
     const sweepIdleSessions = async () => {
         const cutoff = Date.now() - sessionTtlMs;
@@ -270,6 +392,23 @@ export async function startHttpTransport(createServerFactory, options) {
                     return;
                 }
             }
+            // Origin validation (MCP 2025-11-25): a browser-initiated request coming
+            // from an unexpected origin must be rejected with 403. A *missing* Origin
+            // is allowed — non-browser clients (curl, gateways, MCP CLI clients)
+            // never send one, and the Host check above already covers DNS rebinding.
+            // Like the Host check, this runs after /healthz so probes stay unaffected,
+            // and it skips the RFC 9728 discovery document: that document is public,
+            // credential-free and read-only, and a browser client only fetches it
+            // *because* we pointed it there from a 401 challenge — 403ing it would
+            // dead-end the OAuth bootstrap the challenge just started.
+            if (originPolicy.enabled && !isDiscoveryPath(req.url, options.path)) {
+                const originHeader = req.headers.origin;
+                const origin = Array.isArray(originHeader) ? originHeader[0] : originHeader;
+                if (origin && !isOriginAllowed(originPolicy, origin)) {
+                    writeJsonRpcError(res, 403, `Invalid Origin: ${origin}`);
+                    return;
+                }
+            }
             // Reject oversized payloads up front when the client advertises the
             // length, before buffering anything. The streaming guard in
             // readJsonBody still covers chunked / lying Content-Length cases.
@@ -282,10 +421,7 @@ export async function startHttpTransport(createServerFactory, options) {
             // Public OAuth2 discovery endpoint (RFC 9728). Not served in static-auth
             // mode — exposing it would cause OAuth-aware clients (mcp-remote, etc.)
             // to attempt a full OAuth dance that will never complete.
-            if (!options.staticAuth &&
-                req.method === "GET" &&
-                (url.pathname === "/.well-known/oauth-protected-resource" ||
-                    url.pathname === `/.well-known/oauth-protected-resource${options.path}`)) {
+            if (!options.staticAuth && req.method === "GET" && isDiscoveryPath(url.pathname, options.path)) {
                 writeProtectedResourceMetadata(res);
                 return;
             }